Privacy Policy

Last updated: May 15, 2026

1. Introduction

Moonlit Credit ("we," "us," "our") respects your privacy and is committed to protecting the personal data you share with us. This Privacy Policy explains how we collect, use, store, share, and protect your information when you use our website, Discord bot, Developer API, Cloud VM platform, and related services (collectively, the "Services").

By using our Services, you consent to the data practices described in this Privacy Policy.

2. Information We Collect

2.1 Information You Provide

Data Type	Examples	Purpose
Moonlit Account	Display name, email, password (hashed), avatar	Account creation, authentication, identity
Developer Application	Organization name, occupation, email	Developer access approval
Payment Details	Order ID, amount, payment provider reference	Transaction processing and billing
Contact Inquiries	Name, email, message content	Customer support, responding to inquiries

2.2 Information Collected Automatically

Data Type	Details
Usage Data	API call logs, command usage frequency, session durations
Device Data	Browser type, OS, IP address (for rate limiting and abuse prevention)
Economy Data	M$ balances, transaction history, exchange records, loan status

3. Discord Bot Data

3.1 What We Access via Discord

• User ID: Your unique Discord numeric ID to identify your account in our economy system
• Username & Display Name: For display in leaderboards, receipts, and interactions
• Server Membership: To verify server licensing and command eligibility
• Message Metadata: Message count (not content) for activity-based earning
• Voice Channel Status: Connection state (not audio) for voice activity rewards

3.2 What We Do NOT Access

• Message content (we only count messages; we do not read or store message text)
• Voice audio or recordings
• Direct messages between users (unless the bot sends an automated DM)
• Data from servers where our bot is not installed

4. Developer API Data

4.1 Data Collected

When you use the Developer API, we collect:

• API key usage (which endpoints called, timestamps, response times)
• Request metadata (IP address for rate limiting)
• Credit usage and billing data
• Application details (organization, occupation, Moonlit account ID)

4.2 API Logs

API call logs are retained for 90 days for debugging, auditing, and abuse prevention. After 90 days, logs are aggregated into anonymized statistics and individual records are deleted.

5. Cloud VM Data

5.1 Data Collected from VM Usage

• Instance Metadata: VM ID, OS-key, distro selection, hostname, creation/expiry timestamps
• Access Logs: When a VM is accessed via its URL (timestamp and IP for abuse prevention)
• Resource Metrics: CPU, memory, and disk allocation records

5.2 What We Do NOT Collect from VMs

• File contents or user data created within the VM
• Commands executed within the VM terminal
• Network traffic originating from or destined to the VM
• Screenshots or screen recordings of VM sessions

5.3 Ephemeral Data

Cloud VMs are ephemeral. All user-created data within a VM is destroyed when the session expires or the VM is terminated. We do not back up or retain any user-generated content from VM sessions.

6. Payment Data

6.1 Payment Processing

We use third-party payment processors (PayPal, Xsolla) to handle all financial transactions. We never store:

• Full credit/debit card numbers
• CVV/CVC codes
• Banking login credentials
• UPI PINs or sensitive payment authentication data

6.2 Transaction Records

We maintain records of completed transactions including order IDs, amounts, timestamps, and M$ credited. These records are used for billing support, dispute resolution, and auditing purposes.

7. How We Use Your Data

We use collected data for the following purposes:

• Service Delivery: Operating the economy, processing commands, managing accounts
• Security & Fraud Prevention: Detecting abuse, preventing exploits, rate limiting
• Analytics: Understanding usage patterns, improving services, optimizing performance
• Communication: Sending transactional notifications (DMs for approvals, rewards, receipts)
• Legal Compliance: Fulfilling legal obligations and responding to lawful requests

We do not sell, rent, or trade your personal data to third parties for marketing purposes.

8. Data Storage & Security

8.1 Storage Location

Data is stored on our servers and may be replicated across backup systems for redundancy. Economy data is stored in JSON file databases on our hosting infrastructure.

8.2 Security Measures

• Passwords are hashed with salt using industry-standard algorithms (we never store plaintext passwords)
• API keys are stored securely and transmitted only over HTTPS
• Session tokens have automatic expiration (7 days for web sessions)
• Administrative access requires API key verification
• CORS headers restrict API access to authorized origins

8.3 Incident Response

In the event of a data breach, we will notify affected users within 72 hours via Discord DM and/or email, and take immediate steps to mitigate the breach.

9. Data Sharing & Third Parties

We may share your data with:

• Payment Processors: PayPal, Xsolla — for processing financial transactions
• Discord: Your Discord user data is accessed via Discord's API under their Terms
• Hosting Providers: Our servers are hosted on infrastructure that may process your data
• Law Enforcement: When required by law, court order, or to protect the safety of our users

We do not share your data with advertisers, data brokers, or any other third parties for commercial purposes.

10. Cookies & Local Storage

10.1 What We Use

Our website uses local storage (not cookies) to store:

• Session tokens for authentication
• Account display data (name, avatar) for UI rendering
• UI preferences (theme, dismissed notifications)

10.2 No Third-Party Tracking

We do not use third-party tracking cookies, advertising pixels, or analytics services that track you across websites. We do not participate in ad networks.

11. Data Retention

Data Category	Retention Period
Account Data	Until account deletion requested
Transaction History	Last 10,000 transactions retained
API Logs	90 days (then anonymized)
VM Instance Records	30 days after termination
Payment Records	7 years (legal/tax compliance)
Session Tokens	7 days (auto-expiry)

12. Your Rights

You have the following rights regarding your personal data:

• Access: Request a copy of the data we hold about you
• Correction: Request correction of inaccurate or incomplete data
• Deletion: Request deletion of your account and associated data (subject to legal retention requirements)
• Portability: Request your data in a machine-readable format
• Objection: Object to specific data processing activities

To exercise any of these rights, contact us via our Discord support server or email.

13. Children's Privacy

Our Services are not intended for children under the age of 13. We do not knowingly collect personal data from children under 13. If we become aware that a child under 13 has provided us with personal data, we will take steps to delete such information promptly.

Users between 13 and 18 must have parental or guardian consent to use our Services, in accordance with Discord's Terms of Service.

14. International Data Transfers

Our Services may be accessed from outside India. By using our Services, you consent to the transfer and processing of your data in India and other jurisdictions where our infrastructure is hosted. We take reasonable steps to ensure your data is treated securely regardless of where it is processed.

15. Changes to This Policy

We may update this Privacy Policy from time to time. Significant changes will be announced in our Discord server. The "Last Updated" date at the top of this page indicates when the policy was last revised. Your continued use of the Services after any changes constitutes acceptance of the updated policy.

16. Contact Us

If you have questions, concerns, or requests related to your privacy or data, please contact us:

• Discord: Join Support Server
• Email: getkey@00000911.xyz
• Website: Contact Page